CVE-2026-13190

COMPONENT VERSION RANGE

NewScan fingerprints Telerik UI for ASP.NET AJAX from its response and reports this CVE when the detected version falls inside the affected range below.

The framework-level unsafe type resolution the two persistence CVEs above sit on top of, and the reason its lower bound (2011.2.712) differs from theirs. RadPersistenceManager / RadDockLayout, not RadAsyncUpload, so it is a separate chain from the 13181-13184 batch and has no public exploit. Version-match only: whether a given app uses cookie-based or file-based persistence storage is not observable from outside, so the row reports the vulnerable BUILD rather than asserting the configuration.